Transparency.c File Reference

Try to hide the debugger from anti-debugging and anti-hypervisor methods. More...

#include "pch.h"

Functions
BOOLEAN	TransparentHideDebugger (HYPEREVADE_CALLBACKS *HyperevadeCallbacks, DEBUGGER_HIDE_AND_TRANSPARENT_DEBUGGER_MODE *TransparentModeRequest)
	Hide debugger on transparent-mode (activate transparent-mode).
BOOLEAN	TransparentUnhideDebugger ()
	Deactivate transparent-mode.
UINT32	TransparentGetRand ()
	Generate a random number by utilizing RDTSC instruction.
BOOLEAN	TransparentAddNameOrProcessIdToTheList (PDEBUGGER_HIDE_AND_TRANSPARENT_DEBUGGER_MODE Measurements)
	Add name or process id of the target process to the list of processes that HyperDbg should apply transparent-mode on them.

Detailed Description

Try to hide the debugger from anti-debugging and anti-hypervisor methods.

Author

Sina Karvandi (sina@.nosp@m.hype.nosp@m.rdbg..nosp@m.org)

jtaw5649

Version

0.1

Date

2020-07-07

Copyright

This project is released under the GNU Public License v3.

Function Documentation

TransparentAddNameOrProcessIdToTheList()

BOOLEAN TransparentAddNameOrProcessIdToTheList

(

PDEBUGGER_HIDE_AND_TRANSPARENT_DEBUGGER_MODE

Measurements

)

Add name or process id of the target process to the list of processes that HyperDbg should apply transparent-mode on them.

Parameters

Measurements

Pointer to the debugger hide and transparent mode request structure

Returns

BOOLEAN

{
    SIZE_T                SizeOfBuffer;
    PTRANSPARENCY_PROCESS PidAndNameBuffer;
 
    //
    // Check whether it's a process id or it's a process name
    //
    if (Measurements->TrueIfProcessIdAndFalseIfProcessName)
    {
        //
        // It's a process Id
        //
        SizeOfBuffer = sizeof(TRANSPARENCY_PROCESS);
    }
    else
    {
        //
        // It's a process name
        //
        SizeOfBuffer = sizeof(TRANSPARENCY_PROCESS) + Measurements->LengthOfProcessName;
    }
 
    //
    // Allocate the Buffer
    //
    PidAndNameBuffer = PlatformMemAllocateZeroedNonPagedPool(SizeOfBuffer);
 
    if (PidAndNameBuffer == NULL)
    {
        return FALSE;
    }
 
    //
    // Save the address of the buffer for future de-allocation
    //
    PidAndNameBuffer->BufferAddress = PidAndNameBuffer;
 
    //
    // Check again whether it's a process id or it's a process name
    // then fill the structure
    //
    if (Measurements->TrueIfProcessIdAndFalseIfProcessName)
    {
        //
        // It's a process Id
        //
        PidAndNameBuffer->ProcessId                            = Measurements->ProcId;
        PidAndNameBuffer->TrueIfProcessIdAndFalseIfProcessName = TRUE;
    }
    else
    {
        //
        // It's a process name
        //
        PidAndNameBuffer->TrueIfProcessIdAndFalseIfProcessName = FALSE;
 
        //
        // Move the process name string to the end of the buffer
        //
        RtlCopyBytes((VOID *)((UINT64)PidAndNameBuffer + sizeof(TRANSPARENCY_PROCESS)),
                     (CONST VOID *)((UINT64)Measurements + sizeof(DEBUGGER_HIDE_AND_TRANSPARENT_DEBUGGER_MODE)),
                     Measurements->LengthOfProcessName);
 
        //
        // Set the process name location
        //
        PidAndNameBuffer->ProcessName = (PVOID)((UINT64)PidAndNameBuffer + sizeof(TRANSPARENCY_PROCESS));
    }
 
    //
    // Link it to the list of process that we need to transparent
    // vm-exits for them
    //
    // InsertHeadList(&g_TransparentModeMeasurements->ProcessList, &(PidAndNameBuffer->OtherProcesses));
 
    return TRUE;
}

TransparentGetRand()

UINT32 TransparentGetRand

(

)

Generate a random number by utilizing RDTSC instruction.

Masking 16 LSB of the measured clock time.

Returns

UINT32

{
    UINT64 Tsc;
    UINT32 Rand;
 
    Tsc  = CpuReadTsc();
    Rand = Tsc & 0xffff;
 
    return Rand;
}

TransparentHideDebugger()

BOOLEAN TransparentHideDebugger	(	HYPEREVADE_CALLBACKS *	HyperevadeCallbacks,
		DEBUGGER_HIDE_AND_TRANSPARENT_DEBUGGER_MODE *	TransparentModeRequest )

Hide debugger on transparent-mode (activate transparent-mode).

Parameters

HyperevadeCallbacks	Pointer to the HyperEvade callbacks structure
TransparentModeRequest	Pointer to the transparent debugger mode request

Returns

BOOLEAN

{
    UINT32 EvadeMask = TransparentModeRequest->EvadeMask;
 
    if (EvadeMask == 0)
    {
        EvadeMask = TRANSPARENT_EVADE_MASK_DEFAULT;
    }
 
    if ((EvadeMask & ~TRANSPARENT_EVADE_MASK_ALL) != 0)
    {
        TransparentModeRequest->KernelStatus = DEBUGGER_ERROR_UNABLE_TO_HIDE_OR_UNHIDE_DEBUGGER;
        return FALSE;
    }
 
    //
    // Check if any of the required callbacks are NULL
    //
    for (UINT32 i = 0; i < sizeof(HYPEREVADE_CALLBACKS) / sizeof(UINT64); i++)
    {
        if (((PVOID *)HyperevadeCallbacks)[i] == NULL)
        {
            //
            // The callback has null entry, so we cannot proceed
            //
            TransparentModeRequest->KernelStatus = DEBUGGER_ERROR_UNABLE_TO_HIDE_OR_UNHIDE_DEBUGGER;
            return FALSE;
        }
    }
 
    //
    // Save the callbacks
    //
    RtlCopyMemory(&g_Callbacks, HyperevadeCallbacks, sizeof(HYPEREVADE_CALLBACKS));
 
    //
    // Check whether the transparent-mode was already initialized or not
    //
    if (!g_TransparentMode)
    {
        //
        // Store the system-call numbers information
        //
        RtlCopyBytes(&g_SystemCallNumbersInformation,
                     &TransparentModeRequest->SystemCallNumbersInformation,
                     sizeof(SYSTEM_CALL_NUMBERS_INFORMATION));
#if ActivateHyperEvadeProject == TRUE
        //
        // Choose a random genuine vendor string to replace hypervisor vendor data
        //
        g_TransparentGenuineVendorStringIndex = TransparentGetRand() %
                                                (sizeof(TRANSPARENT_LEGIT_VENDOR_STRINGS_WCHAR) / sizeof(TRANSPARENT_LEGIT_VENDOR_STRINGS_WCHAR[0]));
#endif
 
        //
        // Enable the transparent mode
        //
        g_TransparentMode                    = TRUE;
        g_TransparentEvadeMask               = EvadeMask;
        TransparentModeRequest->EvadeMask    = EvadeMask;
        TransparentModeRequest->KernelStatus = DEBUGGER_OPERATION_WAS_SUCCESSFUL;
 
        //
        // Successfully enabled the transparent-mode
        //
        return TRUE;
    }
    else
    {
        TransparentModeRequest->KernelStatus = DEBUGGER_ERROR_DEBUGGER_ALREADY_HIDE;
        return FALSE;
    }
}

TransparentUnhideDebugger()

BOOLEAN TransparentUnhideDebugger

(

)

Deactivate transparent-mode.

Returns

BOOLEAN

{
    if (g_TransparentMode)
    {
        //
        // Disable the transparent-mode
        //
        g_TransparentMode      = FALSE;
        g_TransparentEvadeMask = 0;
 
        return TRUE;
    }
    else
    {
        return FALSE;
    }
}